switchroom 0.20.0 → 0.20.2

package/bin/handoff-briefing.sh

@@ -47,7 +47,29 @@ HINDSIGHT_BANK="${HINDSIGHT_BANK_ID:-}"
 AGENT_DIR="${AGENT_DIR:-}"
 WORKSPACE_DIR="${WORKSPACE_DIR:-$AGENT_DIR}"
 MAX_MESSAGES="${HANDOFF_BRIEFING_MAX_MESSAGES:-20}"
-HINDSIGHT_TIMEOUT="${HANDOFF_BRIEFING_HINDSIGHT_TIMEOUT:-4}"
+# Hindsight is the only network hop; cap it at 3s so it finishes well inside
+# start.sh's outer `timeout 10` kill budget (was 4s under a 5s outer, which
+# left almost no margin — a slow recall could be killed mid-write). Local
+# SQLite + daily-memory reads are sub-second, so 3s is the whole network cost.
+HINDSIGHT_TIMEOUT="${HANDOFF_BRIEFING_HINDSIGHT_TIMEOUT:-3}"
+
+# Chat/thread scope for the recent-conversation section (#continuity). A
+# forum/group agent's history.db holds messages from many topics; an unscoped
+# "last 20" briefing pollutes the reorientation with unrelated threads. Prefer
+# the surface that was mid-turn when the prior session ended (exported by
+# start.sh from the pending-turn env on an interrupted boot); otherwise the
+# python fallback derives the single most-recently-active (chat_id, thread_id)
+# surface straight from the DB. Empty chat ⇒ let python derive it.
+#
+# TARGET_THREAD_ID is tri-state: a numbered thread scopes to that topic; the
+# literal sentinel `NULL` means the surface's thread is genuinely NULL (a DM /
+# forum General topic) and scopes with `thread_id IS NULL`; empty means the
+# thread is UNKNOWN and falls back to chat-only scope (all threads). The
+# pending-turn env writer emits `NULL` when it knows the interrupted turn's
+# thread was null, so a General-topic interrupt reboots correctly scoped
+# instead of pulling in every other topic's messages.
+TARGET_CHAT_ID="${SWITCHROOM_PENDING_CHAT_ID:-}"
+TARGET_THREAD_ID="${SWITCHROOM_PENDING_THREAD_ID:-}"
 
 # Determine output mode
 STDOUT_MODE=0
@@ -61,28 +83,119 @@ if [ -n "$TELEGRAM_STATE" ] && [ -d "$TELEGRAM_STATE" ]; then
   HISTORY_DB="$TELEGRAM_STATE/history.db"
   if [ -f "$HISTORY_DB" ] && command -v python3 >/dev/null 2>&1; then
     # Use python3's stdlib sqlite3 — no bun:sqlite, no extra deps.
-    # Query the most recent $MAX_MESSAGES rows ordered by ts DESC, then
-    # reverse for chronological display. We skip system messages (role NULL).
-    TELEGRAM_ROWS=$(python3 - "$HISTORY_DB" "$MAX_MESSAGES" 2>/dev/null <<'PYEOF'
+    # Query the most recent $MAX_MESSAGES rows for the ACTIVE surface only
+    # (chat/thread-scoped, see above), ordered by ts DESC, then reverse for
+    # chronological display. We skip system messages (role NULL). The scope
+    # source is logged to stderr for boot diagnostics.
+    # python stderr is NOT suppressed: the script's only stderr output is the
+    # intentional scope breadcrumb + a single graceful line on any caught error
+    # (every DB path is wrapped in try/except → sys.exit(0)). start.sh runs this
+    # under `2>/dev/null`, so the breadcrumb is a debug/manual-run diagnostic.
+    TELEGRAM_ROWS=$(python3 - "$HISTORY_DB" "$MAX_MESSAGES" "$TARGET_CHAT_ID" "$TARGET_THREAD_ID" <<'PYEOF'
 import sys, sqlite3, datetime
 
 db_path = sys.argv[1]
 limit = int(sys.argv[2])
+target_chat = sys.argv[3] if len(sys.argv) > 3 else ""
+target_thread = sys.argv[4] if len(sys.argv) > 4 else ""
 
 try:
     conn = sqlite3.connect(db_path)
     conn.row_factory = sqlite3.Row
     cur = conn.cursor()
-    # Fetch most recent rows; reverse for chronological output.
+
+    # Resolve the surface to scope to.
+    #  - explicit env target (pending-turn chat/thread) wins — UNLESS that chat
+    #    has zero rows (rotated/fresh DB), in which case we fall through to
+    #    db-latest so a stale env target doesn't yield an empty section;
+    #  - else derive the single most-recently-active (chat_id, thread_id).
+    # thread is tri-state: a real value, NULL (DM / general), or unknown.
+    #  - target_thread == "NULL" (sentinel from start.sh / pending-turn-env)
+    #    means the surface's thread is GENUINELY NULL (DM / general topic) —
+    #    scope with `thread_id IS NULL`, do NOT pull in numbered-thread rows.
+    #  - target_thread == "" (empty) means UNKNOWN — chat-only scope (all
+    #    threads), the safe backward-compatible fallback.
+    scope_chat = None
+    scope_thread = None          # int thread id
+    scope_thread_known = False   # True once we know the exact thread (incl. NULL)
+    scope_thread_is_null = False # True when the surface's thread is NULL
+    scope_source = "unscoped"
+
+    def _chat_has_rows(chat_id):
+        cur.execute(
+            "SELECT 1 FROM messages WHERE role IN ('user', 'assistant') "
+            "AND chat_id = ? LIMIT 1",
+            [chat_id],
+        )
+        return cur.fetchone() is not None
+
+    def _derive_db_latest():
+        # The single most-recently-active (chat_id, thread_id) surface.
+        cur.execute(
+            """
+            SELECT chat_id, thread_id
+            FROM messages
+            WHERE role IN ('user', 'assistant')
+            ORDER BY ts DESC
+            LIMIT 1
+            """
+        )
+        return cur.fetchone()
+
+    # Env target — accept it only when its chat actually has rows (2b). A
+    # rotated/fresh DB can leave a pending-turn chat with no persisted
+    # messages; scoping to it would silently emit an empty section, so we
+    # fall through to db-latest instead.
+    if target_chat and _chat_has_rows(target_chat):
+        scope_chat = target_chat
+        scope_source = "env"
+        if target_thread == "NULL":
+            scope_thread_is_null = True
+            scope_thread_known = True
+        elif target_thread != "":
+            try:
+                scope_thread = int(target_thread)
+                scope_thread_known = True
+            except ValueError:
+                scope_thread = None  # unparseable → chat-only scope
+        # else: unknown thread → chat-only scope (all threads of the chat)
+
+    if scope_chat is None:
+        latest = _derive_db_latest()
+        if latest is not None:
+            scope_chat = latest["chat_id"]
+            scope_source = "db-latest"
+            scope_thread_known = True
+            if latest["thread_id"] is None:
+                scope_thread_is_null = True
+            else:
+                scope_thread = latest["thread_id"]
+
+    if scope_chat is None:
+        # Empty DB (nothing to scope) — nothing to show.
+        sys.stderr.write("handoff-briefing: no messages to scope; empty section\n")
+        sys.exit(0)
+
+    where = ["role IN ('user', 'assistant')", "chat_id = ?"]
+    params = [scope_chat]
+    if scope_thread_known:
+        if scope_thread_is_null:
+            where.append("thread_id IS NULL")
+        else:
+            where.append("thread_id = ?")
+            params.append(scope_thread)
+    params.append(limit)
+
+    sys.stderr.write(
+        "handoff-briefing: scoping recent conversation to chat=%s thread=%s (source=%s)\n"
+        % (scope_chat, "NULL" if scope_thread_is_null else (scope_thread if scope_thread_known else "any"), scope_source)
+    )
+
     cur.execute(
-        """
-        SELECT role, user, ts, text
-        FROM messages
-        WHERE role IN ('user', 'assistant')
-        ORDER BY ts DESC
-        LIMIT ?
-        """,
-        (limit,),
+        "SELECT role, user, ts, text FROM messages WHERE "
+        + " AND ".join(where)
+        + " ORDER BY ts DESC LIMIT ?",
+        params,
     )
     rows = list(reversed(cur.fetchall()))
     conn.close()
@@ -110,6 +223,70 @@ $TELEGRAM_ROWS"
   fi
 fi
 
+# ── Header (cheap, no network) — computed early so the recent-conversation
+# section can be flushed to disk BEFORE the slow Hindsight hop. ──────────────
+# Restart timestamp — model-facing: it lands in the resume-turn system prompt
+# via --append-system-prompt ("You just restarted at …"). Render the agent's
+# LOCAL am/pm wall clock, NOT UTC, so the restart turn never sees a competing
+# UTC "now". Same SWITCHROOM_TIMEZONE → TZ → UTC cascade the daily section uses.
+_TZ_VAL="${SWITCHROOM_TIMEZONE:-${TZ:-UTC}}"
+TIMESTAMP=$(TZ="$_TZ_VAL" date '+%A %Y-%m-%d %I:%M %p %Z' 2>/dev/null || date '+%A %Y-%m-%d %I:%M %p %Z')
+RESTART_REASON="unknown"
+if [ -n "$AGENT_DIR" ] && [ -f "$AGENT_DIR/.restart-reason" ]; then
+  RESTART_REASON=$(cat "$AGENT_DIR/.restart-reason" 2>/dev/null | head -1 | tr -d '\r\n')
+fi
+if [ -n "${SWITCHROOM_PENDING_ENDED_VIA:-}" ]; then
+  RESTART_REASON="$SWITCHROOM_PENDING_ENDED_VIA"
+fi
+BRIEFING_HEADER="You just restarted at ${TIMESTAMP}. Previous session ended via: ${RESTART_REASON}. Consult this briefing before responding."
+
+# Resolve the output destination up front (file mode only).
+OUTPUT_FILE=""
+OUTPUT_TMP=""
+if [ "$STDOUT_MODE" != "1" ] && [ -n "$AGENT_DIR" ]; then
+  OUTPUT_FILE="$AGENT_DIR/.handoff-briefing.md"
+  OUTPUT_TMP="${OUTPUT_FILE}.tmp.$$"
+fi
+
+# Incremental emit (#continuity). Sections are flushed to the output file as
+# each source resolves — the recent-conversation section (the highest-value,
+# always-local part) is written BEFORE the network-bound Hindsight hop. So a
+# late-stage kill (e.g. start.sh's outer `timeout`, SIGTERM by default) mid-Hindsight still
+# leaves the recent conversation on disk instead of nothing. The first flush
+# writes header+section atomically via tmp+mv; later sections append. In
+# stdout/no-AGENT_DIR mode we buffer and print once at the end instead.
+FILE_STARTED=0
+STDOUT_BUFFER=""
+emit_section() {
+  # $1 = section content (assumed non-empty)
+  section="$1"
+  if [ -n "$OUTPUT_FILE" ]; then
+    if [ "$FILE_STARTED" = "0" ]; then
+      # First section: header + divider + section, written atomically.
+      printf '%s\n\n---\n\n%s' "$BRIEFING_HEADER" "$section" > "$OUTPUT_TMP" \
+        && mv -f "$OUTPUT_TMP" "$OUTPUT_FILE"
+      FILE_STARTED=1
+    else
+      printf '\n\n---\n\n%s' "$section" >> "$OUTPUT_FILE"
+    fi
+  else
+    if [ -z "$STDOUT_BUFFER" ]; then
+      STDOUT_BUFFER="$section"
+    else
+      STDOUT_BUFFER="$STDOUT_BUFFER
+
+---
+
+$section"
+    fi
+  fi
+}
+
+# Flush the recent-conversation section NOW, before Hindsight.
+if [ -n "$TELEGRAM_SECTION" ]; then
+  emit_section "$TELEGRAM_SECTION"
+fi
+
 # ── Source 2: Hindsight recall ──────────────────────────────────────────────────
 HINDSIGHT_SECTION=""
 if [ -n "$HINDSIGHT_URL" ] && [ -n "$HINDSIGHT_BANK" ] && command -v curl >/dev/null 2>&1 && command -v jq >/dev/null 2>&1; then
@@ -133,14 +310,16 @@ $RECALL_TEXT"
     fi
   fi
 fi
+if [ -n "$HINDSIGHT_SECTION" ]; then
+  emit_section "$HINDSIGHT_SECTION"
+fi
 
 # ── Source 3: Today's daily memory ─────────────────────────────────────────────
-# Resolve "today" in the agent's LOCAL time — NOT the process default (UTC on
-# most hosts/CI). TODAY keys the daily-memory lookup (memory/${TODAY}.md); using
-# UTC here would look up the wrong day's file during the window where the local
-# date is ahead of/behind UTC, silently dropping today's memory. Same
-# SWITCHROOM_TIMEZONE → TZ → UTC cascade the restart-timestamp render below uses.
-_TZ_VAL="${SWITCHROOM_TIMEZONE:-${TZ:-UTC}}"
+# TODAY keys the daily-memory lookup (memory/${TODAY}.md) in the agent's LOCAL
+# time (_TZ_VAL, resolved in the header block above) — NOT the process default
+# (UTC on most hosts/CI). Using UTC here would look up the wrong day's file
+# during the window where the local date is ahead of/behind UTC, silently
+# dropping today's memory.
 DAILY_SECTION=""
 TODAY=$(TZ="$_TZ_VAL" date +%Y-%m-%d 2>/dev/null || date +%Y-%m-%d 2>/dev/null || true)
 if [ -n "$TODAY" ] && [ -n "$WORKSPACE_DIR" ]; then
@@ -154,66 +333,26 @@ $DAILY_CONTENT"
     fi
   fi
 fi
-
-# ── Assemble briefing ───────────────────────────────────────────────────────────
-# Restart timestamp — model-facing: it lands in the resume-turn system prompt
-# via --append-system-prompt ("You just restarted at …"). Render the agent's
-# LOCAL am/pm wall clock, NOT UTC, so the restart turn never sees a competing
-# UTC "now" (the whole point of the deterministic-local-time work). Same
-# SWITCHROOM_TIMEZONE → TZ → UTC cascade and `%A %Y-%m-%d %I:%M %p %Z` am/pm
-# format the UserPromptSubmit local-time hook (bin/timezone-hook.sh) uses.
-# (_TZ_VAL is computed once above, in the daily-memory section.)
-TIMESTAMP=$(TZ="$_TZ_VAL" date '+%A %Y-%m-%d %I:%M %p %Z' 2>/dev/null || date '+%A %Y-%m-%d %I:%M %p %Z')
-
-# Determine restart reason if available
-RESTART_REASON="unknown"
-if [ -n "$AGENT_DIR" ] && [ -f "$AGENT_DIR/.restart-reason" ]; then
-  RESTART_REASON=$(cat "$AGENT_DIR/.restart-reason" 2>/dev/null | head -1 | tr -d '\r\n')
+if [ -n "$DAILY_SECTION" ]; then
+  emit_section "$DAILY_SECTION"
 fi
-# Also check SWITCHROOM_PENDING_ENDED_VIA if set by start.sh
-if [ -n "${SWITCHROOM_PENDING_ENDED_VIA:-}" ]; then
-  RESTART_REASON="$SWITCHROOM_PENDING_ENDED_VIA"
-fi
-
-# Build the briefing body
-SECTIONS=""
-for section in "$TELEGRAM_SECTION" "$HINDSIGHT_SECTION" "$DAILY_SECTION"; do
-  if [ -n "$section" ]; then
-    if [ -n "$SECTIONS" ]; then
-      SECTIONS="$SECTIONS
-
----
 
-$section"
-    else
-      SECTIONS="$section"
-    fi
+# ── Finalize ────────────────────────────────────────────────────────────────────
+# Every section was flushed as it resolved (emit_section). Here we only close
+# out the chosen sink. An all-empty briefing wrote nothing — leave it that way
+# so start.sh skips the --append-system-prompt arg.
+if [ -n "$OUTPUT_FILE" ]; then
+  # File mode. FILE_STARTED=1 means at least one section was written atomically
+  # (header+first) with the rest appended; add the trailing newline the
+  # single-shot writer used to emit. If nothing was written, no file exists.
+  if [ "$FILE_STARTED" = "1" ]; then
+    printf '\n' >> "$OUTPUT_FILE"
   fi
-done
-
-# Empty briefing — nothing to inject
-if [ -z "$SECTIONS" ]; then
-  exit 0
-fi
-
-BRIEFING="You just restarted at ${TIMESTAMP}. Previous session ended via: ${RESTART_REASON}. Consult this briefing before responding.
-
----
-
-${SECTIONS}"
-
-# ── Output ──────────────────────────────────────────────────────────────────────
-if [ "$STDOUT_MODE" = "1" ]; then
-  printf '%s\n' "$BRIEFING"
 else
-  if [ -z "$AGENT_DIR" ]; then
-    # Fallback: write to stdout if AGENT_DIR is not set
-    printf '%s\n' "$BRIEFING"
-    exit 0
+  # stdout / no-AGENT_DIR mode — buffered; print the whole briefing once.
+  if [ -n "$STDOUT_BUFFER" ]; then
+    printf '%s\n\n---\n\n%s\n' "$BRIEFING_HEADER" "$STDOUT_BUFFER"
   fi
-  OUTPUT_FILE="$AGENT_DIR/.handoff-briefing.md"
-  OUTPUT_TMP="${OUTPUT_FILE}.tmp.$$"
-  printf '%s\n' "$BRIEFING" > "$OUTPUT_TMP" && mv -f "$OUTPUT_TMP" "$OUTPUT_FILE"
 fi
 
 exit 0

package/dist/agent-scheduler/index.js

@@ -11362,7 +11362,7 @@ var BuzzChannelSchema = exports_external.object({
   default_channel_id: exports_external.string().describe("Relay-minted group UUID (the NIP-29 `h` tag) the sidecar subscribes " + "to and stamps on injected turns."),
   channel_map: exports_external.record(exports_external.string(), exports_external.string()).default({}).describe("Optional map of extra group UUIDs → friendly labels."),
   pubkey_names: exports_external.record(exports_external.string(), exports_external.string()).default({}).describe("Optional petnames: hex/npub pubkey → display name, used to label " + "the sender on injected turns."),
-  pinned_relay_digest: exports_external.string().optional().describe("Pinned relay image digest (M4). The compat-check warns on mismatch; " + "advisory in Phase 1.")
+  pinned_relay_digest: exports_external.string().optional().describe("Pinned relay image digest (M4). RESERVED — no consumer of this field " + "exists; the existing compat-check (compat-check.ts) validates only " + "the wire contract (AUTH kind, message kind, tag names) and does not " + "read this field. Kept in the schema so the intended digest-pin can " + "be wired without a config shape change.")
 }).strict();
 var ChannelsSchema = exports_external.object({
   telegram: TelegramChannelSchema,
@@ -11419,7 +11419,7 @@ var HindsightConfigSchema = exports_external.object({
     reflect: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `reflect` LLM op (synthesis / mental-model " + "refresh). Emits `HINDSIGHT_API_REFLECT_LLM_*`. Absent → uses global."),
     consolidation: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `consolidation` LLM op (background memory " + "merge). Emits `HINDSIGHT_API_CONSOLIDATION_LLM_*`. Absent → global.")
   }).optional().describe("LLM knob for the hindsight container. The flat `provider`/`model` set " + "the global default (backward-compatible); optional `retain`/`reflect`/" + "`consolidation` blocks override individual ops. All fields optional; " + "unset fields fall back to the hard-coded defaults."),
-  env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_RESERVED_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, GRAPH_SEED_MIN_SIMILARITY, " + "LLM_SUPPORTS_MAX_ITEMS, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS — switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP — the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS — only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS — the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_RESERVED_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_RESERVED_SLOTS — the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool; and " + "the pre-0.8.6 name HINDSIGHT_API_WORKER_<TYPE>_MAX_SLOTS is still " + "accepted for every operation type and normalised to " + "..._RESERVED_SLOTS on the way in, because setting both names for " + "one type is a hard boot failure in the engine and switchroom " + "therefore emits only the canonical name; and " + "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY — the cosine-similarity floor a " + "candidate must reach to be returned by the semantic retrieval arm at " + "all (0..1); unset means upstream's own 0.3, and where it should sit " + "depends on the bank's embedding model and phrasing diversity, so " + "switchroom ships no opinion; and " + "HINDSIGHT_MCP_RECALL_BUDGET_MODE — the rollback knob for switchroom's " + "mcp-recall-token-budget image patch; `legacy` restores upstream's " + "exact pre-patch recall returns, anything else or unset is the " + "honest-envelope mode; and " + "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT — upstream's own per-op reflect " + "temperature knob, made live by switchroom's reflect-temperature image " + "patch; a float, or `none` to omit the kwarg (provider default, " + "upstream's accidental pre-patch behaviour); unset means the image's " + "baked default 0.1; and " + "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT — the background " + "half of switchroom's recall-admission split (#3660): of the " + "RECALL_MAX_CONCURRENT admission slots, at most this many may be held " + "by background consolidation recalls at once, so foreground per-turn " + "recall always keeps the remainder; must be >= 1 and strictly less " + "than RECALL_MAX_CONCURRENT or the engine refuses to boot; unset " + "means the image's derived default min(2, RECALL_MAX_CONCURRENT - 1); " + "1 biases hard toward the interactive lane while a consolidation " + "backlog drains; and " + "HINDSIGHT_MM_REFRESH_MIN_INTERVAL_S — the rollback/tuning knob for " + "switchroom's MM-refresh-debounce image patch: the minimum seconds " + "between consolidation-triggered refreshes of one mental model; unset " + "means the image's baked 3600, 0 restores upstream's " + "refresh-every-round behaviour; explicit and cron-scheduled refreshes " + "are never debounced), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
+  env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_RESERVED_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, GRAPH_SEED_MIN_SIMILARITY, " + "LLM_SUPPORTS_MAX_ITEMS, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS — switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP — the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS — only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS — the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_RESERVED_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_RESERVED_SLOTS — the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool; and " + "the pre-0.8.6 name HINDSIGHT_API_WORKER_<TYPE>_MAX_SLOTS is still " + "accepted for every operation type and normalised to " + "..._RESERVED_SLOTS on the way in, because setting both names for " + "one type is a hard boot failure in the engine and switchroom " + "therefore emits only the canonical name; and " + "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY — the cosine-similarity floor a " + "candidate must reach to be returned by the semantic retrieval arm at " + "all (0..1); unset means upstream's own 0.3, and where it should sit " + "depends on the bank's embedding model and phrasing diversity, so " + "switchroom ships no opinion; and " + "HINDSIGHT_MCP_RECALL_BUDGET_MODE — the rollback knob for switchroom's " + "mcp-recall-token-budget image patch; `legacy` restores upstream's " + "exact pre-patch recall returns, anything else or unset is the " + "honest-envelope mode; and " + "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT — upstream's own per-op reflect " + "temperature knob, made live by switchroom's reflect-temperature image " + "patch; a float, or `none` to omit the kwarg (provider default, " + "upstream's accidental pre-patch behaviour); unset means the image's " + "baked default 0.1; and " + "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT — the background " + "half of switchroom's recall-admission split (#3660): of the " + "RECALL_MAX_CONCURRENT admission slots, at most this many may be held " + "by background consolidation recalls at once, so foreground per-turn " + "recall always keeps the remainder; must be >= 1 and strictly less " + "than RECALL_MAX_CONCURRENT or the engine refuses to boot; unset " + "means the image's derived default min(2, RECALL_MAX_CONCURRENT - 1); " + "1 biases hard toward the interactive lane while a consolidation " + "backlog drains; and " + "HINDSIGHT_MM_REFRESH_MIN_INTERVAL_S — the rollback/tuning knob for " + "switchroom's MM-refresh-debounce image patch: the minimum seconds " + "between consolidation-triggered refreshes of one mental model; unset " + "means the image's baked 3600, 0 restores upstream's " + "refresh-every-round behaviour; explicit and cron-scheduled refreshes " + "are never debounced; and " + "HINDSIGHT_API_TEMPORAL_LANGUAGES — the language set dateparser is " + "restricted to during temporal query analysis, made live by switchroom's " + "temporal-language image patch (which ended a 200+-locale auto-detection " + "pass that blocked the shared asyncio loop on every recall); " + "comma-separated, unset means the image's baked `en`, set e.g. `en,es` to " + "restore i18n parsing), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
 });
 var MicrosoftWorkspaceConfigSchema = exports_external.object({
   microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),

package/dist/auth-broker/index.js

@@ -11387,7 +11387,7 @@ var init_schema = __esm(() => {
     default_channel_id: exports_external.string().describe("Relay-minted group UUID (the NIP-29 `h` tag) the sidecar subscribes " + "to and stamps on injected turns."),
     channel_map: exports_external.record(exports_external.string(), exports_external.string()).default({}).describe("Optional map of extra group UUIDs → friendly labels."),
     pubkey_names: exports_external.record(exports_external.string(), exports_external.string()).default({}).describe("Optional petnames: hex/npub pubkey → display name, used to label " + "the sender on injected turns."),
-    pinned_relay_digest: exports_external.string().optional().describe("Pinned relay image digest (M4). The compat-check warns on mismatch; " + "advisory in Phase 1.")
+    pinned_relay_digest: exports_external.string().optional().describe("Pinned relay image digest (M4). RESERVED — no consumer of this field " + "exists; the existing compat-check (compat-check.ts) validates only " + "the wire contract (AUTH kind, message kind, tag names) and does not " + "read this field. Kept in the schema so the intended digest-pin can " + "be wired without a config shape change.")
   }).strict();
   ChannelsSchema = exports_external.object({
     telegram: TelegramChannelSchema,
@@ -11444,7 +11444,7 @@ var init_schema = __esm(() => {
       reflect: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `reflect` LLM op (synthesis / mental-model " + "refresh). Emits `HINDSIGHT_API_REFLECT_LLM_*`. Absent → uses global."),
       consolidation: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `consolidation` LLM op (background memory " + "merge). Emits `HINDSIGHT_API_CONSOLIDATION_LLM_*`. Absent → global.")
     }).optional().describe("LLM knob for the hindsight container. The flat `provider`/`model` set " + "the global default (backward-compatible); optional `retain`/`reflect`/" + "`consolidation` blocks override individual ops. All fields optional; " + "unset fields fall back to the hard-coded defaults."),
-    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_RESERVED_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, GRAPH_SEED_MIN_SIMILARITY, " + "LLM_SUPPORTS_MAX_ITEMS, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS — switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP — the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS — only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS — the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_RESERVED_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_RESERVED_SLOTS — the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool; and " + "the pre-0.8.6 name HINDSIGHT_API_WORKER_<TYPE>_MAX_SLOTS is still " + "accepted for every operation type and normalised to " + "..._RESERVED_SLOTS on the way in, because setting both names for " + "one type is a hard boot failure in the engine and switchroom " + "therefore emits only the canonical name; and " + "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY — the cosine-similarity floor a " + "candidate must reach to be returned by the semantic retrieval arm at " + "all (0..1); unset means upstream's own 0.3, and where it should sit " + "depends on the bank's embedding model and phrasing diversity, so " + "switchroom ships no opinion; and " + "HINDSIGHT_MCP_RECALL_BUDGET_MODE — the rollback knob for switchroom's " + "mcp-recall-token-budget image patch; `legacy` restores upstream's " + "exact pre-patch recall returns, anything else or unset is the " + "honest-envelope mode; and " + "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT — upstream's own per-op reflect " + "temperature knob, made live by switchroom's reflect-temperature image " + "patch; a float, or `none` to omit the kwarg (provider default, " + "upstream's accidental pre-patch behaviour); unset means the image's " + "baked default 0.1; and " + "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT — the background " + "half of switchroom's recall-admission split (#3660): of the " + "RECALL_MAX_CONCURRENT admission slots, at most this many may be held " + "by background consolidation recalls at once, so foreground per-turn " + "recall always keeps the remainder; must be >= 1 and strictly less " + "than RECALL_MAX_CONCURRENT or the engine refuses to boot; unset " + "means the image's derived default min(2, RECALL_MAX_CONCURRENT - 1); " + "1 biases hard toward the interactive lane while a consolidation " + "backlog drains; and " + "HINDSIGHT_MM_REFRESH_MIN_INTERVAL_S — the rollback/tuning knob for " + "switchroom's MM-refresh-debounce image patch: the minimum seconds " + "between consolidation-triggered refreshes of one mental model; unset " + "means the image's baked 3600, 0 restores upstream's " + "refresh-every-round behaviour; explicit and cron-scheduled refreshes " + "are never debounced), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
+    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_RESERVED_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, GRAPH_SEED_MIN_SIMILARITY, " + "LLM_SUPPORTS_MAX_ITEMS, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS — switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP — the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS — only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS — the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_RESERVED_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_RESERVED_SLOTS — the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool; and " + "the pre-0.8.6 name HINDSIGHT_API_WORKER_<TYPE>_MAX_SLOTS is still " + "accepted for every operation type and normalised to " + "..._RESERVED_SLOTS on the way in, because setting both names for " + "one type is a hard boot failure in the engine and switchroom " + "therefore emits only the canonical name; and " + "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY — the cosine-similarity floor a " + "candidate must reach to be returned by the semantic retrieval arm at " + "all (0..1); unset means upstream's own 0.3, and where it should sit " + "depends on the bank's embedding model and phrasing diversity, so " + "switchroom ships no opinion; and " + "HINDSIGHT_MCP_RECALL_BUDGET_MODE — the rollback knob for switchroom's " + "mcp-recall-token-budget image patch; `legacy` restores upstream's " + "exact pre-patch recall returns, anything else or unset is the " + "honest-envelope mode; and " + "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT — upstream's own per-op reflect " + "temperature knob, made live by switchroom's reflect-temperature image " + "patch; a float, or `none` to omit the kwarg (provider default, " + "upstream's accidental pre-patch behaviour); unset means the image's " + "baked default 0.1; and " + "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT — the background " + "half of switchroom's recall-admission split (#3660): of the " + "RECALL_MAX_CONCURRENT admission slots, at most this many may be held " + "by background consolidation recalls at once, so foreground per-turn " + "recall always keeps the remainder; must be >= 1 and strictly less " + "than RECALL_MAX_CONCURRENT or the engine refuses to boot; unset " + "means the image's derived default min(2, RECALL_MAX_CONCURRENT - 1); " + "1 biases hard toward the interactive lane while a consolidation " + "backlog drains; and " + "HINDSIGHT_MM_REFRESH_MIN_INTERVAL_S — the rollback/tuning knob for " + "switchroom's MM-refresh-debounce image patch: the minimum seconds " + "between consolidation-triggered refreshes of one mental model; unset " + "means the image's baked 3600, 0 restores upstream's " + "refresh-every-round behaviour; explicit and cron-scheduled refreshes " + "are never debounced; and " + "HINDSIGHT_API_TEMPORAL_LANGUAGES — the language set dateparser is " + "restricted to during temporal query analysis, made live by switchroom's " + "temporal-language image patch (which ended a 200+-locale auto-detection " + "pass that blocked the shared asyncio loop on every recall); " + "comma-separated, unset means the image's baked `en`, set e.g. `en,es` to " + "restore i18n parsing), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
   });
   MicrosoftWorkspaceConfigSchema = exports_external.object({
     microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
@@ -19169,7 +19169,8 @@ var HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS = new Set([
   "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT",
   "HINDSIGHT_API_RETAIN_WALL_TIMEOUT",
   "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT",
-  "HINDSIGHT_MM_REFRESH_MIN_INTERVAL_S"
+  "HINDSIGHT_MM_REFRESH_MIN_INTERVAL_S",
+  "HINDSIGHT_API_TEMPORAL_LANGUAGES"
 ]);
 var HINDSIGHT_WORKER_SLOT_TYPES = [
   "consolidation",